test: coverage-guided fuzz targets and a nightly fuzz job

rust/fuzz (cargo-fuzz, nightly, its own workspace with the same IronRDP
patches) has targets for the Telnet IAC parser, the IRC parser + state
machine + mIRC formatter, VNC framebuffer updates and decoders,
~/.ssh/config parsing and the update manifest. They reach the private
parsers through hidden entry points behind nexus-core's 'fuzzing'
feature. A nightly workflow runs each for two minutes and uploads any
crashing input. A first 45 s run of each locally found nothing.

rust/core/src/updater.rs

@@ -142,6 +142,13 @@ fn leading_int(s: Option<&&str>) -> i64 {
 }
 
 /// Cuts at `max` bytes (backing off to a char boundary) and appends "…".
+/// Fuzzing entry point: `data` as an update manifest response.
+#[cfg(feature = "fuzzing")]
+#[doc(hidden)]
+pub fn fuzz_manifest(data: &[u8]) {
+    let _ = parse_manifest(data, "1.2.3");
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;